URL: https://captcha.spaceprotect.net/
Submission Tags: phishingrod
Submission: On November 22 via api from DE — Scanned from GB

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 198.244.223.245, located in London, United Kingdom and belongs to OVH, FR. The main domain is captcha.spaceprotect.net.
TLS certificate: Issued by R3 on November 22nd 2022. Valid for: 3 months.
This is the only time captcha.spaceprotect.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 198.244.223.245 16276 (OVH)
1 2a00:1450:400... 15169 (GOOGLE)
1 54.91.59.199 14618 (AMAZON-AES)
3 4
Apex Domain
Subdomains
Transfer
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2887
265 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 304
88 KB
1 spaceprotect.net
captcha.spaceprotect.net
598 KB
3 3
Domain Requested by
1 api.ipify.org ajax.googleapis.com
1 ajax.googleapis.com captcha.spaceprotect.net
1 captcha.spaceprotect.net
3 3

This site contains no links.

Subject Issuer Validity Valid
captcha.spaceprotect.net
R3
2022-11-22 -
2023-02-20
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA
2022-02-07 -
2023-03-10
a year crt.sh

This page contains 1 frames:

Primary Page: https://captcha.spaceprotect.net/
Frame ID: 9E2E451DB78DC7B7514984273B2E5B96
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

SpaceProtect × Just a moment ...

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

687 kB
Transfer

904 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
captcha.spaceprotect.net/
598 KB
598 KB
Document
General
Full URL
https://captcha.spaceprotect.net/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
198.244.223.245 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip245.ip-198-244-223.eu
Software
SpaceProtect /
Resource Hash
4ce65832fbc70dfb1e791e246c2bf36606df5dd4176182ab9fd8c1e0da4c620a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Anti-DDoS
SpaceProtect | spaceprotect.net
Cache-Control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Content-Type
text/html; charset=utf-8
DDoS-Protection
SpaceProtect | https://spaceprotect.net/
Date
Tue, 22 Nov 2022 23:55:13 GMT
Expires
0
Pragma
no-cache
Server
SpaceProtect
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/
87 KB
88 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: captcha.spaceprotect.net
URL: https://captcha.spaceprotect.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://captcha.spaceprotect.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 23:36:27 GMT
x-content-type-options
nosniff
age
1126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
89501
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Nov 2023 23:36:27 GMT
truncated
/
219 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d4a361e80c1f5da880ca15d54faa31c9f9c1ee1b17047133c2e45fb6b72032e3

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
/
api.ipify.org/
24 B
265 B
XHR
General
Full URL
https://api.ipify.org/?format=json
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.91.59.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-91-59-199.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
f34f484e5cf512c819bde3a7aa72e883a1043c8b47a2f582ada517a6199907db

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://captcha.spaceprotect.net/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 23:55:14 GMT
Via
1.1 vegur
Server
Cowboy
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://captcha.spaceprotect.net
Connection
keep-alive
Content-Length
24

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| testBrowser function| writeToBlock function| testUserAgent function| testAppVersion function| testPlugins function| testPluginsPrototype function| writePluginsPrototypeResult function| testMime function| testMimePrototype function| writeMimePrototypeResult function| testLanguages function| testWebdriver function| webdriverWriteResult function| testChrome function| chromeWriteResult function| testPermission function| permissionWriteResult function| testDevtool function| devtoolWriteResult function| testOuter function| testConnectionRtt function| connectionRttWriteResult

1 Cookies

Domain/Path Name / Value
captcha.spaceprotect.net/ Name: eJkrqX6oG_AuBF8Qab6wq4X75-Y
Value: pB8AzYhlHn5V0VBfNDXHGwp_dp0

1 Console Messages

Source Level URL
Text
network error URL: https://captcha.spaceprotect.net/
Message:
Failed to load resource: the server responded with a status of 503 (Service Temporarily Unavailable)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block